Skip to content

Fix #62179: Restrict import attribute values to string literals#62638

Closed
sdotson wants to merge 5 commits intomicrosoft:mainfrom
sdotson:bug/do-not-allow-js-expressions-in-attrs
Closed

Fix #62179: Restrict import attribute values to string literals#62638
sdotson wants to merge 5 commits intomicrosoft:mainfrom
sdotson:bug/do-not-allow-js-expressions-in-attrs

Conversation

@sdotson
Copy link
Copy Markdown

@sdotson sdotson commented Oct 20, 2025

Summary

Fixed Issue #62179: Import type attributes were incorrectly accepting arbitrary JavaScript expressions instead of only string literals.

Changes Made:

  1. Parser Fix (src/compiler/parser.ts:8447)
    - Changed parseAssignmentExpressionOrHigher() to parseLiteralLikeNode(SyntaxKind.StringLiteral)
    - Now properly restricts import attribute values to string literals only
  2. New Test (tests/cases/compiler/importTypeAttributesNonString.ts)
    - Tests that non-string values (functions, numbers, arrays, objects, etc.) are properly rejected
    - Verifies string literals still work correctly
  3. Updated Tests
    - Fixed existing tests to reflect the new parser behavior

Fixes issue #62179

Copilot AI review requested due to automatic review settings October 20, 2025 16:37
@github-project-automation github-project-automation bot moved this to Not started in PR Backlog Oct 20, 2025
@typescript-bot typescript-bot added the For Uncommitted Bug PR for untriaged, rejected, closed or missing bug label Oct 20, 2025
@typescript-bot
Copy link
Copy Markdown
Collaborator

This PR doesn't have any linked issues. Please open an issue that references this PR. From there we can discuss and prioritise.

1 similar comment
@typescript-bot
Copy link
Copy Markdown
Collaborator

This PR doesn't have any linked issues. Please open an issue that references this PR. From there we can discuss and prioritise.

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR fixes issue #62179 by restricting import attribute values to string literals only, preventing arbitrary JavaScript expressions from being used. The parser previously accepted any expression (functions, numbers, arrays, etc.) in import attributes, which violated the ECMAScript specification.

Key changes:

  • Modified the parser to only accept string literals as import attribute values
  • Added comprehensive test coverage for various invalid expression types
  • Updated existing test baselines to reflect the stricter parser behavior

Reviewed Changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated no comments.

Show a summary per file
File Description
src/compiler/parser.ts Changed parser to use parseLiteralLikeNode(SyntaxKind.StringLiteral) instead of parseAssignmentExpressionOrHigher() for import attribute values
tests/cases/compiler/importTypeAttributesNonString.ts New test file validating rejection of non-string expressions and acceptance of valid string literals
tests/cases/fourslash/organizeImportsAttributes4.ts Removed test case with numeric attribute value (now invalid)
tests/baselines/reference/importTypeAttributesNonString.* Baseline files for the new test showing expected errors for invalid attribute values
tests/baselines/reference/importAttributes6(module=). Updated baselines reflecting changed parser behavior producing syntax errors instead of type errors
tests/baselines/reference/importAssertionNonstring.* Updated baselines for import assertions with non-string values

~~~~~~~~~~~
!!! error TS1005: ':' expected.
~~~~~~
!!! error TS2880: Import assertions have been replaced by import attributes. Use 'with' instead of 'assert'.
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The error messages in this test are much worse now

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think they should be better now. Thank you for the review.

@github-project-automation github-project-automation bot moved this from Not started to Waiting on author in PR Backlog Oct 20, 2025
@sdotson sdotson requested a review from RyanCavanaugh October 20, 2025 20:19
@typescript-bot
Copy link
Copy Markdown
Collaborator

With 6.0 out as the final release vehicle for this codebase, we're closing all PRs that don't fit the merge criteria for post-6.0 patches. If you think this was a mistake and this PR fits the post-6.0 patch criteria, please post to the 6.0 iteration issue with details (specifically, which PR and which patch criteria it satisfies).

Next steps for PRs:

  • For crash bugfixes or language service improvements, PRs are currently accepted at the typescript-go repo
  • Changes to type system behavior should wait until after 7.0, at which point mainline TypeScript development will resume in this repository with the Go codebase
  • Library file updates (lib.d.ts etc) continue to live in this repo or the DOM Generator repo as appropriate

@github-project-automation github-project-automation bot moved this from Waiting on author to Done in PR Backlog Mar 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

For Uncommitted Bug PR for untriaged, rejected, closed or missing bug

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

4 participants